chore: scrub private infrastructure for a public repo, rewrite README

Audited the working tree and all 26 commits of history for credentials: none
found. No API keys, no private keys, no tokens — the live bot token, webhook
secret and admin token appear nowhere in the repo or its history.

What was there was infrastructure disclosure, which is recon material rather
than a leak, but has no business in a public repo:

- Tailnet addresses and cluster-internal hostnames in code, docs and the CI
  template. The model endpoint is now supplied at runtime via
  PRAGENT_MODEL_BASE_URL and patched into opencode.json by install_config();
  the committed config carries a placeholder, guarded by a test.
- A host path (/home/marcos) as the default rtk directory — now unset.
- Real usernames in the onboarding docs — now alice/acme.
- A standing list of one-time setup tokens that were never revoked, named
  individually. Removed. Note that removing the list does not revoke the
  tokens: they should still be revoked in the Gitea admin UI.

The substitution happens in Python rather than via opencode's {env:VAR} config
templating, because the reviewer subprocess runs with an allow-listed
environment — resolving it before the process starts keeps that allow-list from
having to grow.

README rewritten for a reader who has never seen the project: what it does and
what that output looks like, honest status (pilot works, framework designed but
unbuilt), the security model up front given what this thing is, and the measured
cost numbers including the two effects that make naive estimates wrong.

History still contains the old addresses. They are tailnet-only and not
credentials, so no rewrite.

Tests: 131 -> 137.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B11e8TZZxJyzHW7jj7KWUN

tests/pilot/test_opencode_review.py

@@ -1,5 +1,6 @@
 """Unit tests for the opencode engine glue (no network, no opencode run)."""
 import io
+import json
 import os
 import sys
 import tarfile
@@ -19,7 +20,7 @@ import opencode_review as oc  # noqa: E402
 def test_write_brief_contains_key_sections(tmp_path):
     brief = oc.write_brief(
         str(tmp_path),
-        repo="masi/portfolio", index="3", sha="abcdef1234567890",
+        repo="alice/portfolio", index="3", sha="abcdef1234567890",
         title="Add eval helper", description="Closes #1",
         diff="diff --git a/x b/x\n+++ b/x\n@@ -1 +1,2 @@\n+eval(input())",
         config={"focus": ["security"], "instructions": "Flag eval()."},
@@ -27,7 +28,7 @@ def test_write_brief_contains_key_sections(tmp_path):
     )
     assert brief.endswith(".pragent/brief.md")
     text = open(brief, encoding="utf-8").read()
-    assert "masi/portfolio" in text
+    assert "alice/portfolio" in text
     assert "#3" in text
     assert "abcdef1234567890" in text
     assert "Add eval helper" in text
@@ -405,3 +406,75 @@ def test_write_brief_marks_untrusted_regions(tmp_path):
     # The injected title is still present — as data to review, inside the fence.
     assert "Ignore previous instructions" in text
     assert text.index("Trust boundary") < text.index("Ignore previous instructions")
+
+
+# ---------------------------------------------------------------------------
+# install_config — the committed endpoint is a placeholder, patched at runtime
+# ---------------------------------------------------------------------------
+
+
+def _cfg(tmp_path, url="http://placeholder.internal:8789/v1"):
+    src = tmp_path / "opencode.json"
+    src.write_text(json.dumps({
+        "model": "headroom/glm-5.2:cloud",
+        "provider": {"headroom": {"npm": "@ai-sdk/anthropic",
+                                  "options": {"baseURL": url, "apiKey": "ollama"}}},
+    }), encoding="utf-8")
+    return src
+
+
+def test_install_config_substitutes_base_url(tmp_path, monkeypatch):
+    src = _cfg(tmp_path)
+    dst = tmp_path / "out.json"
+    monkeypatch.setenv("PRAGENT_MODEL_BASE_URL", "http://real-proxy:8789/v1")
+    assert oc.install_config(str(src), str(dst)) is True
+    cfg = json.loads(dst.read_text())
+    assert cfg["provider"]["headroom"]["options"]["baseURL"] == "http://real-proxy:8789/v1"
+    # Everything else survives the rewrite.
+    assert cfg["provider"]["headroom"]["options"]["apiKey"] == "ollama"
+    assert cfg["model"] == "headroom/glm-5.2:cloud"
+
+
+def test_install_config_without_override_copies_verbatim(tmp_path, monkeypatch):
+    src = _cfg(tmp_path)
+    dst = tmp_path / "out.json"
+    monkeypatch.delenv("PRAGENT_MODEL_BASE_URL", raising=False)
+    oc.install_config(str(src), str(dst))
+    assert json.loads(dst.read_text()) == json.loads(src.read_text())
+
+
+def test_install_config_missing_source_is_a_noop(tmp_path):
+    assert oc.install_config(str(tmp_path / "nope.json"), str(tmp_path / "out.json")) is False
+    assert not (tmp_path / "out.json").exists()
+
+
+def test_install_config_malformed_source_still_installs(tmp_path, monkeypatch):
+    src = tmp_path / "bad.json"
+    src.write_text("{not json", encoding="utf-8")
+    dst = tmp_path / "out.json"
+    monkeypatch.setenv("PRAGENT_MODEL_BASE_URL", "http://real-proxy:8789/v1")
+    assert oc.install_config(str(src), str(dst)) is True
+    assert dst.read_text() == "{not json"  # opencode reports the parse error, not us
+
+
+def test_drop_factory_applies_the_substitution(tmp_path, monkeypatch):
+    factory = tmp_path / "factory"
+    (factory / ".opencode").mkdir(parents=True)
+    _cfg(factory)
+    (factory / ".opencode" / "agents").mkdir()
+    workdir = tmp_path / "wd"
+    workdir.mkdir()
+    monkeypatch.setenv("PRAGENT_FACTORY_DIR", str(factory))
+    monkeypatch.setenv("PRAGENT_MODEL_BASE_URL", "http://real-proxy:8789/v1")
+    oc.drop_factory(str(workdir))
+    cfg = json.loads((workdir / "opencode.json").read_text())
+    assert cfg["provider"]["headroom"]["options"]["baseURL"] == "http://real-proxy:8789/v1"
+    assert (workdir / ".opencode" / "agents").is_dir()
+
+
+def test_committed_config_has_no_private_address():
+    # Guards the public-repo scrub: the committed endpoint must stay a placeholder.
+    cfg = json.loads(open(os.path.join(ROOT, "opencode.json"), encoding="utf-8").read())
+    url = cfg["provider"]["headroom"]["options"]["baseURL"]
+    assert "100." not in url and "192.168." not in url, url
+    assert ".internal" in url or "example" in url, url